A Berlin state government official has confirmed that hackers are attempting to extort the city after its administrative network was compromised earlier this month. Berlin has refused to pay the ransom demand, saying that Berlin will not be paying the attackers. The Senate Department for Mobility, Transport, Climate Protection, and Environment was affected by the incident.
An initial data leak was detected on August 7, followed by forensic analysis that detected additional exfiltrations between August 7 and August 12. On August 14, authorities took down the company's network as a result of the breach. As part of the response, the Senate Department for Urban Development, Construction, and Housing network was also shut down. There is currently no indication as to how much data has been stolen.
Senate Chancellery officials have reported that the investigation is still in progress and that the extent and nature of the data removed from the network cannot be ruled out. A figure circulating from the attackers claims that more than 5.7 TB of data has been stolen, including records relating to more than 12,000 individuals.
The city has not disclosed the extent of the data exfiltrated.
On August 28, the ransomware group published the claim on their leak site. Berlin has not independently verified those figures, but the threat actor has also claimed that the stolen material included financial documents, contracts, human resources files, legal documents, complaints, passwords, and other confidential information.
More than 16,000 email addresses and nearly 12,000 phone numbers are reported in the claimed haul.
Despite not publicly identifying the attackers, the Rhysida ransomware group has claimed responsibility, briefly listing the city on its Tor-based leak site. The group has reportedly requested 30 Bitcoins, worth approximately $2.3 million, in exchange for not disclosing the unauthorized data.
Investigation Continues as Scope of Breach Remains Unclear
Until the full scope of the compromise has been established, forensic investigators confirmed that additional data was collected from the Senate Department for Mobility, Transport, Climate Protection and the Environment between August 7 and August 12, before the affected departments were disconnected from Berlin's state network on August 14.
Rhysida has provided an extensive list of alleged stolen information, however, their claims have not been fully verified.
Around 1.44 million files are reportedly contained within the claimed 5.79 TB haul, including government, legal, financial, contractual, and human resources documents. Also included in the list are identity documents, payroll information, email archives, database dumps, banking information, credentials, and more.
The group has also tried to press Berlin into paying through the alleged exposure of sensitive records.
According to Rhysida, she threatened to publish the stolen files, citing potential GDPR violations as a further means of leverage. The Berlin Senate's Iris Spranger asserted that, despite the extent of the claims, no evidence has been provided to support election-related systems. There has been no evidence that election data has been compromised, according to Spranger.
Rhysida's initial access method has not been disclosed. As a result of the lack of details, there is no clear indication of the entry point and the circumstances under which the attackers gained access to the administrative network. Investigations are continuing by Berlin's State Criminal Police Office, the Public Prosecutors' Office, and federal security agencies.
Since its inception in 2023, Rhysida has been targeting government bodies, healthcare providers, educational institutions and critical infrastructure organizations. Researchers have linked the group to hundreds of attacks, making its claim against Berlin part of a broader pattern of attacks against public networks. It is still unclear whether Berlin has determined the full extent of the data theft or verified all information allegedly released by the attackers as part of the ongoing investigation.
Read the original article: